State Discrimination with Post- Measurement Information 
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Abstract 

We introduce a new state discrimination problem in which we are given additional informa- 
tion about the state after the measurement, or more generally, after a quantum memory bound 
applies. In particular, the following special case plays an important role in quantum crypto- 
graphic protocols in the bounded storage model: Given a string x encoded in an unknown basis 
chosen from a set of mutually unbiased bases, you may perform any measurement, but then 
store at most q qubits of quantum information. Later on, you learn which basis was used. How 
well can you compute a function f[x) of x, given the initial measurement outcome, the q qubits 
and the additional basis information? We first show a lower bound on the success probabil- 
ity for any balanced function, and any number of mutually unbiased bases, beating the naive 
strategy of simply guessing the basis. We then show that for two bases, any Boolean function 
f(x) can be computed perfectly if you are allowed to store just a single qubit, independent of 
the number of possible input strings x. However, we show how to construct three bases, such 
that you need to store all qubits in order to compute f(x) perfectly. We then investigate how 
much advantage the additional basis information can give for a Boolean function. To this end, 
we prove optimal bounds for the success probability for the AND and the XOR function for up 
to three mutually unbiased bases. Our result shows that the gap in success probability can be 
maximal: without the basis information, you can never do better than guessing the basis, but 
with this information, you can compute fix) perfectly. We also exhibit an example where the 
extra information does not give any advantage at all. 
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1 Introduction 



State discrimination with post-measurement information concerns the following task: Consider an 
ensemble of quantum states, £ = {p y b,Pyb}, with double indices yb E y x £>, and a number q > 0. 
Suppose Alice sends Bob the state p y b, where she alone knows indices y and b. Bob can perform 
any measurement on his system, but then store at most q qubits (i.e. a Hilbert space of dimension 
2 q ). Afterwards, Alice tells him b. Bob's goal is now to approximate y as accurately as possible. 
Here, this means that he has to make a guess Y, maximizing the success probability 

Psucc = ^PybP^Y = y|state p yb }. 

yb 

For \B\ = 1, i.e. no available post-measurement information, q is irrelevant and Bob's task is 
to discriminate among states p y , a problem studied since the early days of quantum information 
science [il]]. On the other hand, if the p y b all commute, the fact that b comes later - and also the 
magnitude of q - plays no role as Bob can always measure in the common eigenbasis of the states 
without losing any information. 

Hence, a particular case of the general problem that isolates the aspect of the timing between 
measurements and side-information is one where for each fixed b, the states p y b are mutually 
orthogonal: 

MbMy ^ z pyb 1 Pzb- (1) 

Then the difficulty for Bob and the nontrivial dependence of his probability of success on q derive 
from the possibility of non-commuting eigenbases of the sets {p y b} for different b. While for given 
b he can distinguish perfectly between the p y b, the quantum mechanical measurement-disturbance 
principle reduces the success probability if this side-information is delayed. 

In this paper, we focus for the most part on a special case that is of central importance to existing 
protocols in the bounded quantum storage model |l2j . The security of such protocols rests on the 
realistic assumption that a dishonest player cannot store more than q qubits for long periods of time. 
In this model, even bit commitment and oblivious transfer can be implemented securely, which is 
otherwise known to be impossible 22, Efj . H^ |. In particular, we are interested in the following 



question: Consider a function / : X — > y between finite sets, and a set of mutually unbiased 
bases £>, given by unitaries Uq = I, U%, . . . , Um\-\ on a Hilbert space with basis {\x) : x E X}, 
Alice chooses a string x and a basis b where xb is drawn from the distribution Px,B, prepares the 
state Ub\x) and sends it to Bob. When Bob receives the state, he may perform any measurement. 
Afterwards, however, he can store at most q qubits of quantum information. Later, Alice announces 
which basis she had chosen. Bob's task is now to predict y = f(x) as accurately as possible. That 
means that the states in our problem are now given by 

Pyb= P x\B(x)U b \x)(x\ul 

The only difference to Eq. Q is that now we demand the mutual unbiasedness of the joint eigenbases 
of the {pyb} for different b. How well can Bob compute f(x) given the classical outcome of his earlier 
measurement, the q qubits and the additional basis information? In the context of cryptographic 
protocols Bob is a dishonest player who tries to learn some function of the encoded string 
conditioned on the fact that he will later learn the basis and the function. In the oblivious transfer 
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protocol of |l2j], Alice uses two mutually unbiased bases, and secretly chooses a function from a set 
of predetermined functions. She then tells Bob which function he should evaluate together with the 
basis information b. This makes the protocols more complicated and so one might wonder whether 
it is possible to use a fixed Boolean function instead, a question which stood at the beginning of the 
current investigation (see [l2 |. section 3.6 in the arXiv version, where the XOR of an even number 
of bits is shown to be insufficient). However, we show that this is not possible in the suggested 
protocol. In particular, we show that for two bases and any Boolean function /, Bob can succeed 
with probability at least 1/2 + l/(2\/2), even if he cannot store any qubits at all. Surprisingly, it 
also turns out that Bob can determine f{x) perfectly, if he can store just a single qubit. We show 
that one qubit is sufficient no matter how long the input string x actually is. Behind our proof, 
there is an algebraic framework that allows us, in principle, to determine the minimal quantum 
memory resources required and the optimal strategy to succeed with probability 1 for any number 
of bases and any function /. However, it turns out that we can construct three bases, such that 
Bob needs to store all qubits in order to compute a boolean function perfectly. 

In general, we also show a lower bound on Bob's optimal success probability for any balanced 
function / : X — » y, and any number of mutually unbiased bases if he cannot store any qubits. 
Our bound is strictly better than what Bob could achieve by guessing the basis. 

Our problem also has an interpretation in the light of communication complexity. Suppose Alice 
is given b, and Bob is given the state p y b- If classical communication is free, what is the minimal 
number of qubits Bob needs to communicate to Alice such that Alice learns yl It turns out that if 
there exists a strategy for Bob to compute y in our original task while storing only q qubits, he will 
also need to send exactly q qubits, and his classical measurement outcome, to allow Alice to learn 
y: Alice now simply performs the measurement Bob would have done in our original task after he 
received b. 

It is an interesting problem to consider how much the extra basis information helps Bob to 
compute fix). To this end, we first examine how well Bob can compute the AND and XOR of x 
without using the additional basis information. We prove optimal bounds for computing the AND 
and XOR function on a string of length n for two and three mutually unbiased bases. In particular, 
we show that for two mutually unbiased bases and the XOR function on strings of even length, 
Bob's probability of success is at most 3/4, and there exists a strategy which achieves it. This 
means that his trivial strategy of guessing the basis and taking the measurement outcome in that 
basis to be the real answer, is optimal. Interestingly, adding the third basis does not change his 
success probability of 3/4, whereas intuitively one would expect it to be lower. Surprisingly, for 
three bases, if we choose a non-uniform prior distribution over the strings of length n, it actually 
becomes harder for Bob to compute the XOR. We show that there exists a non-uniform distribution 
such that he can never succeed more than using the trivial strategy of guessing the outcome. No 
measurement he can perform will give him any more information. We then examine the case that 
the length of the string n is odd. Here, Bob can succeed only with probability 1/2 + l/(2\/2) 
which is optimal. We prove that for any Boolean function /, Bob's probability of success is upper 
bounded by 1/2 + l/(2y/\B\) if he does not receive any basis information. 

We then examine how well Bob can do with the additional basis information. We show that 
for the XOR function on strings of even length, Bob can now compute the value of the function 
perfectly and give an explicit measurement strategy for Bob. For two bases, this means that the 
gap can be maximal: without the basis information Bob cannot do better than the trivial strategy 
of guessing the basis, however, with this extra information Bob always succeeds. It also means 
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that the gap can be minimal: For the XOR on strings of odd length the extra information does 
not help Bob at all. For three bases we obtain the maximum gap only for a non-uniform prior. 
Finally, we also give an optimal strategy for computing the AND from the given state and the 
post-measurement information. 



1.1 Related work 

State discrimination itself has received considerable attention in the past: Alice prepares a quantum 
state drawn from a collection of possible quantum states. Bob's goal is now to determine the identity 
of the state. The new twist in the present work is that after the measurement, or more generally 
after a memory bound applies, he is given additional information. For the case of only two (mixed) 
states, the optimal measurement for traditional state discrimination was found by Helstrom |2lj ]. 
The case of multiple (mixed) states was already considered by Holevo 22] and Yuen, Kennedy 
and Lax [34| in the 70's, and they have given the necessary conditions for a measurement to be 
optimal. Yuen et al. also showed these conditions to be sufficient and demonstrated that the 
problem of finding the optimal measurement can be expressed as convex optimization problem. 
Discriminating between multiple mixed states remains a difficult problem and it is usually hard to 
derive explicit measurements and bounds from these conditions. Optimal measurements are known 
only for special state sets, which satisfy certain symmetry properties 

Many convex optimization problems can be solved using semidefinite programming. Eldar 
and Eldar, Megretski and Verghese used semidefinite programming to solve state discrimination 
problems, which is one of the techniques we will also use here. The square-root measurement 
(also called pretty good measurement) is an easily constructed measurement to distinguish quantum 
states, however, it is only optimal for very specific sets of states (lfllisj. Mochon constructed specific 
pure state discrimination problems for which the square-root measurement is optimal |29l | . We will 
use a variant of the square-root measurement as well. Furthermore, our problem is related to the 
task of state filtering [a, and state classification j^j]]. Here, Bob's goal is to determine whether 
a given state is either a specific state or one of several other possible states, or, more generally, 
which subset of states a given state belongs to. Our scenario differs, because we deal with mixed 
states and Bob is allowed to use post-measurement information. Much more is known about pure 
state discrimination problems and the case of unambiguous state discrimination where we are not 
allowed to make an error. Since we concentrate on mixed states, we refer to |7( for an excellent 
survey on the extended field of state discrimination. 

Regarding state discrimination with post-measurement information, special instances of the 
general problem have occurred in the literature under the heading "mean king's problem" 1, 25], 
where the stress was on the usefulness of entanglement. Furthermore, it should be noted that 
prepare-and-measure quantum key distribution schemes of the BB84 type also lead to special cases 
of this problem: When considering optimal individual attacks, the eavesdropper is faced with the 
task of extracting maximal information about the raw key bits, encoded in an unknown basis, that 
she learns later during basis reconciliation. 
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2 Preliminaries 



2.1 Notation and tools 

We will need the following notions. The Bell basis is given by the vectors 1^) = (|00> ± |ll»/>/2 
and = (|01)±|10))/ v / 2. Furthermore, let f~ l {y) ={i£ Af|/(ai) = y}. We say that a function 
/ is balanced if and only if any element in the image of / is generated by equally many elements 
in the pre-image of /, i.e. there exists a k G N such that Vy G y : \f~ 1 {y)\ = k. We also use the 
notation [m] = {1, . . . , m}. A* is the conjugate transpose of matrix A. A positive semidefinite nxn 
matrix A is a Hermitian matrix such that x*Ax > for all x G C n 23]. ^4 is said to be positive 
definite, if it is positive semidefinite and x*Ax = implies x = 0. We use A > and A > to 
indicate that ^4 is positive semidefinite and positive definite, respectively. Finally, ||^4||i = TV V A^A 
is the trace norm. The first tool we use is the following well-known result. 

Theorem 2.1 (Helstrom |2l|V Suppose we are given states po with probability q, and p\ with 
probability 1 — q. Then the probability to determine whether the state was po and pi is at most 

p = 2 1 1 + hpo - (i - • 

The measurement that achieves p is given by Mq, and M\ = I — Mo, where Mq is the projector onto 
the positive eigenspace of qpo — (1 — q)p\. □ 

Secondly we will make use of semidefinite programming, which is a special case of convex 
optimization. We refer to f° r an in-depth introduction. The goal of semidefinite programming 
is to solve he following semidefinite program (SDP) in terms of the variable X G S n 

maximize Tr(CX) 

subject to Tr(AiX) = bi, i = 1, . . . ,p, and X > 

for given matrices C,A±,...,A p G S n where S n is the space of symmetric nxn matrices. X is 
called feasible, if it satisfies all constraints. An important aspect of semidefinite programming is 
duality. Intuitively, the idea behind Lagrangian duality is to extend the objective function (here 
Tr(CA)) with a weighted sum of the constraints in such a way, that we will be penalized if the 
constraints are not fulfilled. The weights then correspond to the dual variables. Optimizing over 
these weights then gives rise to the dual problem. The original problem is called the primal problem. 
Let d' denote the optimal value of the dual problem, and p' the optimal value of the primal problem 
stated above. Weak duality says that d! > p 1 . In particular, if we have d! = p' for a feasible dual 
and primal solution respectively, we can conclude that both solutions are optimal. 

We will also need the notion of mutually unbiased bases, which was introduced in :33]. The 
following definition closely follows the one given in 0|. 

Definition 2.2. Let B\ = ■ ■ ■ , \4>d)} an d Bi = {l^l); • • • > iV'd)} be two orthonormal bases in a 

d dimensional Hilbert space. They are said to be mutually unbiased if and only if \(<j)i\ijjj)\ = \j\fd~, 
for every i,j = l,...,d. A set {B\, . . . ,B m } of orthonormal bases in C d is called a set of mutually 
unbiased bases (MUBs) if each pair of bases Bi and Bj is mutually unbiased. 

In any dimension d, the number of mutually unbiased bases is at most d + 1 jj|. Explicit 
constructions are known if d is a prime power 0, yj| or a square j33] ■ We say that a set of unitaries 
{U s } gives rise to |{^7 S }| mutually unbiased bases, if those unitaries generate |{i7 s }| mutually 
unbiased bases when applied to the basis vectors of the computational basis. 
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2.2 Definitions 



We now give a more formal description of our problem. Let y and B be finite sets and let Pyb = 
{Pyb} be a probability distribution over y x B. Consider an ensemble of quantum states £ = 
{PybiPyb}- We assume that y, B, £ and Py,B are known to both Alice and Bob. Suppose now that 
Alice chooses yb £ y x B according to probability distribution Pyb, an d sends p y b to Bob. We can 
then define the tasks: 

Definition 2.3. State discRimination (STAR(£)) is the following task for Bob. Given p y b, deter- 
mine y. He can perform any measurement on p y b immediately upon receipt. 

Definition 2.4. State discRimination with Post-measurement Information (PI„-STAR(£ )) is the 

following task for Bob. Given p y b, determine y, where Bob can use the following sources of infor- 
mation in succession. 

1. He can perform any measurement on p y b immediately upon reception. Afterwards, he can 
store at most q qubits of quantum information about p y b, and an unlimited amount of classical 
information. 

2. After Bob's measurement, Alice announces b. 

3. Then, he may measure the remaining q qubits depending on b and the measurement outcome 
obtained in 1. 

We also say that Bob succeeds at STAR(£) or VI q -STAR{£) with probability p if and only if p is 
the average success probability p = YlybPyb^^i^ = y| state p y b}, where Pr{y = y|state p y b} is the 
probability that Bob correctly determines y given p y b in the case of STAR, and in addition using 
information sources ^ |2 and |3] in the case of PI-STAR. 

In this paper, we are interested in the following special case: Consider a function / : X — * 
y between finite sets, and a set of mutually unbiased bases B generated by a set of unitaries 
Uq, Ui, . . . , U\q\_i acting on a Hilbert space with basis {\x) : x £ X}. Take \$>f) = Ub\x). Let 
Px and Pb be probability distributions over X and B respectively. We assume that /, X, y, B, 
Px, Pb, and the set of unitaries {Ub\b G B} are known to both Alice and Bob. Suppose now that 
Alice chooses x S X and b £ B independently according to probability distributions Px and Pb 
respectively, and sends \&f) to Bob. Bob's goal is now to compute y = f(x). We thus obtain 
an instance of our problem with states p y b = Ylxef- 1 (y) Px(x)\$b)(^b I- We write STAR(/) and 
PIg-STAR(/) to denote both problems in this special case. We concentrate on the case of mutually 
unbiased bases, as this case is most relevant to our initial goal of analyzing protocols for quantum 
cryptography in the bounded storage model 

Here, we will make use of the basis set B = {+, x , ©}, where B + = {|0), |1)} is the computational 
basis, B x = {^(|0) + |1», ^=(|0) - |1))} is the Hadamard basis, and B Q = {^(|0) + i|l)), ^(|0> - 
i|l))} is what we call the K-basis. The unitaries that give rise to these bases are U+ = K, U x = H and 
Uq = K with K = (1 + io~ x ) /\/2 respectively. The Hadamard matrix is given by H = -^(°~x + °~z)- 
o~x, o~ z and a y are the well-known Pauli matrices. We generally assume that Bob has no a priori 
knowledge about the outcome of the function and about the value of b. This means that b is chosen 
uniformly at random from B, and, in the case of balanced functions, that Alice chooses x uniformly 
at random from X. More generally, the distribution is uniform on all and such that each 

value y £ y is equally likely. 
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2.3 A trivial bound: guessing the basis 



Note that a simple strategy for Bob is to guess the basis, and then measure. This approach leads 
to a lower bound on the success probability for both STAR and PI-STAR. In short: 

Lemma 2.5. Let Px{x) = ^ for all x £ {0, l} n . Let B denote the set of bases. Then for any 
balanced function f : X — > y Bob succeeds at STAR(/) and PIo-STAR(/) with probability at least 

Pguess =JB\ + { 1 ~JE\)W\' 

□ 

Our goal is to beat this bound. We show that for PI-STAR, Bob can indeed do much better. 

3 No post-measurement information 

We first consider the standard case of state discrimination. Here, Alice does not supply Bob 
with any additional post-measurement information. Instead, Bob's goal is to compute y = f(x) 
immediately. This analysis will enable us to gain interesting insights into the usefulness of post- 
measurement information later. 

3.1 Two simple examples 

We now examine two simple one qubit examples of a state discrimination problem, which we make 
use of later on. Here, Bob's goal is to learn the value of a bit which has been encoded in two or 
three mutually unbiased bases while he does not know which basis has been used. 

Lemma 3.1. Let x G {0, 1}, Px{x) = \ and f(x) = x. Let B = {+, x} with XJ + = I and U x = H . 
Then Bob succeeds at STAR(/) with probability at most 

1 1 

There exists a strategy for Bob that achieves p. 

Proof. The probability of success follows from Theorem 12 . 1 1 with po = |(|0}(0| + H\0)(0\H), pi = 
+H\1)(1\H) and q = 1/2. ' □ 

Lemma 3.2. Let x £ {0, 1} ; Px{x) = \ and f(x) = x. Let B = {+, x,©} with U+ = I, U x = H 
and Uq = K . Then Bob succeeds at STAR(/) with probability at most 

1 1 

There exists a strategy for Bob that achieves p. 

Proof. The proof is identical to that of Lemma O using p = |(|0)(0| + H\0)(0\H + K^iOlK^), 
p 1 = l(\l)(l\+H\l){l\H + K\l)(l\Ki),ajidq = l/2. " □ 
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3.2 An upper bound for all Boolean functions 

We now show that for any Boolean function / and any number of mutually unbiased bases, the 
probability that Bob succeeds at STAR(/) is very limited. 

Theorem 3.3. Let \y\ = 2 and let f be a balanced function. Then Bob succeeds at STAR(/) with 
probability at most 

1 1 

V = n + 



2 2v^B| 

In particular, for \B\ = 2 we obtain (1 + l/y/2)/2 0.853; for \B\ = 3, we obtain (1 + l/\/3)/2 
0.789. 

Proof. The probability of success is given by Theorem 12 . II where for y £ {0, 1} 

\B\ 

2 n - 1 |fil 



'"'V m-l|R| 1 



6=1 

with P y b = Ej;6/-i(j/) Ub\x) (x\lll . Using the Cauchy-Schwarz inequality we can show that 
\\po - pi||? = [Tr(|p - Pi|I)] 2 < Tr[(p - Pi) 2 ] Tr[I 2 ] = 2 n Tr[(p - Pl )\ 

or 

||po-pi||i < V2 n Tr[(p -pi) 2 ]. (2) 
A simple calculation shows that 

Tr[(p -p 1 ) 2 ] = ^. 

The theorem then follows from the previous equation, together with Theorem 12. II and Eq. (|2"|). □ 
3.3 AND function 

One of the simplest functions to consider is the AND function. Recall, that we always assume that 
Bob has no a priori knowledge about the outcome of the function. In the case of the AND, this 
means that we are considering a very specific prior: with probability 1/2 Alice will choose the only 
string x for which AND(x) = 1. Without any post-measurement information, Bob can already 
compute the AND quite well. 

Theorem 3.4. Let P x (x) = 2(2 »_ 1) for all x £ {0, l} n \ {1...1} and P x (l...l) = \. Let 

B = {+, x} with U+ = I® n , U x = H® n and P B {+) = P B (x) = 1/2. Then Bob succeeds at 
STAR(AND) with probability at most 

P =n + rf 7 f tfn=h (3) 

1 — 2(2 n -i) if n>2. 
There exists a strategy for Bob that achieves p. 
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Proof. Let \a) = |l) 0n and \hi) = [H\l)]® n . Eq. © is obtained by substituting 



1 



p0 = 2 



I-| Cl )( Cl | , I-lh^ih 



Pi 



2 n - 1 
ci)(ci| + | hi) 



and q = 1/2 in Theorem 12.11 □ 

In Theorem 14.31 we will show an optimal bound for the case that Bob does indeed receive 
the extra information. By comparing the previous equation with Eq. (|4"J). one can see that for 
n = 1 announcing the basis does not help. However, for n > 1 we will observe an improvement of 
|2(2 n + 2 n / 2 -2)]- 1 . 

3.4 XOR function 

The XOR function provides an example of a Boolean function where we observe both the largest 
advantage as well as the smallest advantage in receiving post-measurement information: For strings 
of even length we will show that without the extra information Bob can never do better than 
guessing the basis. For strings of odd length, however, he can do quite a bit better. Interestingly, 
it will turn out that in this case the post-measurement information is completely useless to him. 
We first investigate how well Bob does at STAR(XOR) for two bases: 

Theorem 3.5. Let P x (x) = ± for all x G {0, l} n . Let B = {+, x} with U+ = I® n ; U x = H® n 
and Pb{+) = -Pb( x ) = 1/2- Then Bob succeeds at STAR(XOR) with probability at most 




P 



There exists a strategy for Bob that achieves p. 



if n is even, 
if n is odd. 



Proof. Our proof works by induction on n. The case of n = 1 was addressed in Lemma 13.11 Now, 
consider n = 2: Let <Tq = \{p^ + + Pox) anc ^ a i = \(Pi+ + Pix)> where and p\ + are defined as 
Po b b = E^o.il'^exoR-iK) U b \x)(x\ul with o b e {0, 1} and b G B. We have ||crg - a\ \ x = 1. 

We now show that the trace distance does not change when we go from strings of length n to 
strings of length n + 2: Define p™ b with y G {0, 1}, b G {+, x} as in the proof of Theorem 14.71 and 
note that we can express p 1 ^ 2 as before. Let ctq = \{Pq + + Pq x ) and o\ = \{p\ + + P\ x )- A small 



calculation shows that 



We then get that 



T n+2 _ a n+2 = * [{p n + + ^ _ p n + _ ^ ^ | #+)($+ | 

-(pS + + p&x-a»?+-pix)®I*~>(*-| 
+ (^+ + p?x-p?+-p&x)® !*-><*" I 

-(^ + +/>?x-/>? + -^x)®l^ + )(^ + l] 



Fo _cr i 111 = o^ a ° ~ a iW 1 + W a o _cr illi)> 
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where = |(po+ + Pix) an d 5 n = \{Pi+ + Pox)- Consider the unitary U = a® n if n is odd, and 
U = erf n_1 © I if n is even. It is easy to verify that <7q = Ua^U^ and c™ = Ua™W . We thus have 
that ||ctq — o""||i = ||cro ~~ 5" ||i and therefore 

ii n+2 „n+2\\ \\ n „n|| 
IFO ~ °4 111 = ll°o - °1 Hi- 

It then follows from Helstrom's theorem that the maximum probability to distinguish (j'q +2 
from cj™ +2 and thus compute the XOR of the n + 2 bits is given by 

-i II _n .nil 

£ , ll°o ~ a i 111 
2 + 4 

which gives the claimed result. □ 

A similar argument is possible, if we use three mutually unbiased bases. Intuitively, one might 
expect Bob's chance of success to drop as we had more bases. Interestingly, however, we obtain 
the same bound of 3/4 if n is even. 

Theorem 3.6. Let P x {x) = ^ for all x G {0, l} n . Let B = {+, x,©} with U+ = I® n , U x = H® n , 
and U G = K® n with P B {+) = Pb(*) = Pb{Q) = 1/3. Then Bob succeeds at STAR(XOR) with 
probability at most 

{I if n is even, 

5 ^1 + if n is odd. 

There exists a strategy for Bob that achieves p. 

Proof. Our proof is very similar to the case of only 2 mutually unbiased bases. The case of n = 1 
follows from Lemma 13.21 This time, we have for n = 2: o~q = \{Pq + + Pq x + Poo) anc ^ °x = 
§0l+ + Pix + Pi®)- We have [|crg - a\ || x = 1. 

We again show that the trace distance does not change when we go from strings of length n to 
strings of length n + 2. We can compute 

a n+2_ a n+2 = I - ® |* + ><* + | 

+ (5?-5£)® |*-><$- 1 
-K-a ")®|*+><*+|], 

where «r? = (pg + + p^ + p? )/3, <r " = (pj + + p? x + p£ )/3, <rf = (pg + + p n lx + pg )/3, <r " = 
(Pi+ + Pox + Pi )A 5ft = + p% x + ^ )/3, and 5ft = ( Po+ + p? x + p? )/3. Consider the 
unitaries U = a® n , U = af n , and 17 = of" if n is odd, and C/ = a® n ~ l ®I,U = a^" 1 ® I, and 
£/ = CT ®n-i (g) I if n is e ven. It is easily verified that crft = UdfiW, a\ = Ua^W, aft = Uafifr, 
al = Ua%tf, aft = Ua%U\ and a\ = UafU^. We then get that 

ll°o - i 111 = ll°o - °i 111) 
from which the claim follows. □ 
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Surprisingly, if Bob does have some a priori knowledge about the outcome of the XOR the 
problem becomes much harder for Bob. By expressing the states in the Bell basis and using 
Helstrom's result, it is easy to see that if Alice chooses x G {0, l} 2 such that with probability q, 
XOR(x) = 0, and with probability (1 — g), XOR(x) = 1, Bob's probability of learning XOR(x) 
correctly is minimized for q = 1/3. In that case, Bob succeeds with probability at most 2/3, which 
can be achieved by the trivial strategy of ignoring the state he received and always outputting 1. 
This is an explicit example where making a measurement does not aid in state discrimination. It 
has previously been noted by Hunter that such cases can exist in mixed state discrimination. 



4 Using post-measurement information 

We are now ready to advance to the core of our problem. Consider an instance of PIo-STAR with 
a function / : X — ► y and m = \B\ bases, and some priors Px and Pb on the sets X and B. Since 
Bob may not store any quantum information, all his nontrivial actions are contained in the first 
measurement, which must equip him with possible outputs Oj G y for each basis i = 1, . . . ,m. In 
other words, his most general strategy is a POVM with \y\ m outcomes, each labeled by the strings 
o%, ... ,o m for Oi G y and m = \B\. Once Alice has announced b, Bob outputs Y = Ob- Here we 
first prove a general lower bound on the usefulness of post-measurement information that beats the 
guessing bound. Then, we analyze in detail the AND and the XOR function on n bits. 



4.1 A lower bound for balanced functions 

We first give a lower bound on Bob's success probability for any balanced function and any number 
of mutually unbiased bases, by constructing an explicit measurement that achieves it. Without loss 
of generality, we assume in this section that B = [m] , as otherwise we could consider a lexicographic 
ordering of B. 

Theorem 4.1. Let f : X — > y be a balanced function, and let Px and Pb be the uniform distri- 
butions over X and B respectively. Let the set of unitaries {Ub\b G B} give rise to \B\ mutually 
unbiased bases. Choose an encoding such that ^x,x' G X : (x\x ! ) = S xx r. Then Bob succeeds at 
PIq-STAR(/) with probability at least 



P — V guess * 



if m = 2, 



f \y\-i , 
\y\(\y\+3) 

4(|y| 2 -i) f _ o 

3|y|(2+|y|(|y|+6)) tjm-6, 

2_ , 2(|y|+m-l) ifm> d 

2\y\ ~r \y\ 2 +3\y\(m~l)+m 2 -3m+2 lJ " L - 



where p guess is the probability that Bob can achieve by guessing the basis as given in Lemma \2.5\ 
In particular, we always have p > p gue ss- 

Proof. Our proof works by constructing a square-root type measurement that achieves the lower 
bound. As explained above, Bob's strategy for learning f(x) is to perform a measurement with 
\y\ m possible outcomes, labeled by the strings o\, . . . , o m for Oj G y and m = \B\. Once Alice has 
announced b, Bob outputs f(x) = o^. 

Take the projector P yb = Y.xaj-\ y ) \®b)(®b\ and Pyb = l P yb, where k = = \X\/\y\. 

Let M 0lj ... j0m denote the measurement operator corresponding to outcome o%, . . . ,o m . Note that 
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outcome o±, . . . ,o m is the correct outcome for input state p y b if and only if oj, = y. We can then 
write Bob's probability of success as 



w 1 oi,...,o m ey V \fee-B / / 



We will make use of the following measurement: 

3 



^01,...,O m 



(E p ^) with s = E (e p ^) 

\beB ) o 1 ,...,o m ey \b<=B / 



Clearly, we have Z)oi,...,o m ey ^oi,...,o m = I and Voi, . . . , o m G y : M 0lj ... j0m > by construction and 
thus we indeed have a valid measurement. We first show that S = c m I: 

E (e^Y 

oi,...,o m ey \6eB / 

= E E p o b bPo b ,b'P 0bll b" 

o U -,o m eyb,V,b"eB 
= E E P °f 6 + 2 E P °bb P oyV 

o u ...,o m ey \ b bb\b+b> 

+ E P o b b P o b ,b'Po b b + E P o b bPo b ,b'Po b „b" 
bb',b^b' bb'b",b^b'^b" 

= Hyr- 1 + 2m(m - l)|^ m ~ 2 + m(m - l)|^| m " 2 + m(m - l)(m - 2)|^r~ 3 5 2m ] I, 

where we have used the assumption that for any b, P Db b is a projector and EJ^.^ |$^)($^| = I 

which gives J2 0i ey P Oib t = Y. 0x ey ^xef- 1 (y) \®b)(®b\ = ^ We can tnen write Bob 's probability of 
success using this particular measurement as 

1 E ^((e^X 



c m km\y\ 

oi,...,o m ey \ \beB 
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It remains to evaluate this expression. Using the circularity of the trace, we obtain 



E » E^ 

oi,...,o m ey \ \beB 

= E Tr (E p ^ + 6 E p ^ p ^' 

oi,...,o m ey \ b bb*,b^b> 
+ 4 E 

Po b bPoy b' Po b bPo b n b" 

bb'b",b^b'^b" bb'b",b^b'^b" 

+ E Po b bPo b ,b>Po b „b"P 0i l+ E P o b bPo b/ b'Po b bPo b ,b' 

bb'b"b,b^b'^b"^b bb> ,b^b' 

> [m\y\ m - 1 + 6m(m - l)|^| m ~ 2 + 6m(m - l)(m - 2)|yr~ 3 4 n 

+ m(m - l)(m - 2)(m - 3)^™^ 5 2m 5 3m ] Tr(I) + m(m - l)|^| m ~ 2 A;, 

where we have again used the assumption that for any b, P 0bb is a projector and Ylx&x l^&K^&l = ^ 
with Tr(I) = For the last term we have used the following: Note that Tr(P 0bb P y) = A; 2 /!^, 
because we assumed mutually unbiased bases. Let r = rank(P 06 &P ,y). We can then bound 
Tr((P 0bb P 0b/b ,) 2 ) = \i{P 0bb P 0h , v ) 2 > k 4 /(\X\ 2 r) > k 3 /\X\ 2 = k/\y\ 2 , where \(A) is the i-th 
eigenvalue of a matrix A, by noting that r < k since r&nk(P 0bb ) = rank(P /y) = k. Putting things 
together we obtain 



1 

P > 

c m m 



where m = \B\, c m = G m (l) + 3G m (2) + G m (3) and function G m : N — > N defined as G m (i) = 
l^l" 1- * n}=2 <W- This expression can be simplified to obtain the claimed result. □ 



(m—i)\ 



Note that we have only used the assumption that Alice uses mutually unbiased bases in the very 
last step to say that Tr(P 0bb P lb ') = k 2 /\X\. One could generalize our argument to other cases by 
evaluating Tr (P 0b bPo b ,b') approximately. 

In the special case m = \y\ = 2 (i.e. binary function, with two bases) we obtain: 

Corollary 4.2. Let f : {0, l} n — ► {0,1} be a balanced function and let Px{%) = 2~™ for all 
x e {0,l} n . Let B = {0,1} with U = I® n , U x = H® n and P B (0) = P B (1) = 1/2. Then Bob 
succeeds at PI -STAR(/) with probability p > 0.85. □ 

Observe that this almost attains the upper bound of ~ .853 of Lemma [3. II in the case of no post- 
measurement information. Below (in section |SJ) we will show that indeed this bound can always be 
achieved when post-measurement information is available. 

It is perhaps interesting to note that our general bound depends only on the number of function 
values \y\ and the number of bases m. The number of function inputs \X\ itself does not play a 
direct role. 
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4.2 Optimal bounds for the AND and XOR function 



We now show that for some specific functions, the probability of success can even be much larger. 
We hereby concentrate on the case where Alice uses two or three mutually unbiased bases to encode 
her input. Our proofs thereby lead to explicit measurements. In the following, we again assume 
that Bob has no a priori knowledge of the function value. 



4.2.1 AND function 

Theorem 4.3. Let P x (x) = 2(2T !_ 1} for all x G {0, l} n \ {1...1} and P x (l...l) = \. Let 

B = {+, x} with U+ = l® n , U x = H® n and P B {+) = P B (x) = 1/2. Then Bob succeeds at 
PIo-STAR(AND) with probability at most 



2« + 2™/ 2 - 2 2 n - lj ' v ' 

There exists a strategy for Bob that achieves p. 

Proof. To learn the value of AND (a;), Bob uses the same strategy as in the previous section. He 
performs a measurement with 4 possible outcomes, labeled by the strings o+,o x with o + ,o x G 
{0, 1}. Once Alice has announced her basis choice b G {+, x}, Bob outputs AND(x) = 05. Note 
that without loss of generality we can assume that Bob's measurement has only 4 outcomes, i.e. 
Bob only stores 2 bits of classical information because he will only condition his answer on the 
value of b later on. 

Following the approach in the last section, we can write Bob's optimal probability of success as 
a semidefinite program: 

maximize \ E o+ ,o x e{0,i} Tr[6 0+0x M 0+0 J 
subject to Vo + ,o x G {0, 1} : M 0+0x > 0, 

So + ,o x e{0,l} M o+o x = I, 

where 




^00 — Po+ + Pox , b i — Po+ + Pix , 
bio = pi+ + Pox, hi = Pi+ + Pix, 

with Vy € {0, 1}, b e {+, x} : p yb = \ ^ 

i:eAND _1 (j/) Ub\x)(x\U B . Consider H2, the 2 dimensional 
Hilbert space spanned by |ci) = \l)® n and \hx) = \l H )® n . Let |c ) G H 2 and \h ) G H2 be the 
state vectors orthogonal to \c\) and \h\) respectively. They can be expressed as: 

(-l)" +1 |ci) + 2"/ 2 |/n) 
2 n/2 |c 1 ) + (-ir+ 1 |/ ll ) 



\ho) 



V2 n - 1 



Then IT 1 1 = |co)(co| + |ci)(ci| = |/io)(^o| + \hi){hi\ is a projector onto H.2- Let IIj. be a projector 
onto the orthogonal complement of H.2- Note that the b 0+0x are all composed of two blocks, one 
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supported on TL2 and the other on its orthogonal complement. We can thus write 



&oi = 



2n ± 

2 n - 1 

n± 
n± 

2™ - 1 




+ 
+ 



|cq)(cq| + IM(feo| 
2™ - 1 

l c o)(co| 



+ \hi)(h 



2™ - 1 
^TTT + |ci)(ci1 



(5) 



+|ci)(c 1 | + |/i 1 )(/i 



1 ■ 



We give an explicit measurement that achieves p and then show that it is optimal. The full 
derivation of this measurement can be found in the appendix. Take 



Mi 



00 



M. 



o+o x 



n± 

/v o+o x \^o+o x ){^o+o x \, 



with A01 = A10 = (1 + rj) 1 where 



1 - 2/3 2 + (-l) n+1 2/3 A /T^2 v / 2^1 



2 n/2 



77 

IV'oi) = a\co) +P\ci), 
IV'io) =a\h )+P\h 1 ), 

with q and /3 real and satisfying a 2 + [3 2 = 1. We also set Mn = I — M o — M m — M w . We take 



y / 2 2 " + 2i n+1 -2f +1 
Putting it all together, we thus calculate Bob's probability of success: 



P 



2 + 



1 



2" + 2™/ 2 - 2 2 n - 1 



We now show that this is in fact the optimal measurement for Bob. For this we will consider 
the dual of our semidefinite program above: 



J o+o x 



minimize Tr(Q) 
subject to Vo + , o x G {0, 1} : Q > 

Our goal is now to find a Q such that p = Tr(Q) and Q is dual feasible. We can then conclude 
from the duality of SDP that p is optimal. Consider 



Q 



n 



l / 2 — 2 1 + n / 2 _|_ 2 3n / 2 

"2(2™ - 1) + 4 I 2 - 3 • 2™/ 2 + 2 3 ™/ 2 
1 



(|ci)<Cl| + |/ll></ll| 



(-1)" 



4(2 1_ f + 2 n - 3) 



(|ci)(/ii| + |ci)<hi|). 
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Now we only need to show that the Q above satisfies the constraints, i.e. Vo + ,o x £ {0, 1} : Q > 
b 0+ o x /^- Let Q± = n_i_Qn_i_ and Qii = nnQnii. By taking a look at Eq. ® one can easily see that 
Q ± > n±fe °+°x n -L ^ gQ ftia,t j g on }y \ e ft i s h ow that 

Q\\ > - \ " , for o+o x G {0, 1}, o+o x ± 00. 

These are 2x2 matrices and this can be done straightforwardly. We thus have Tr(Q) = p and the 
result follows from the duality of semidefinite programming. □ 

It also follows that if Bob just wants to learn the value of a single bit, he can do no better than 
what he could achieve without waiting for Alice's announcement of the basis b: 

Corollary 4.4. Let x G {0,1}, Px{x) = \ and f(x) = x. Let B = {+, x} with U+ = I and 
U x = H . Then Bob succeeds at PIo-STAR(/) with probability at most 

1 1 

P= 2 + 27T 

There exists a strategy for Bob that achieves p. □ 

The AND function provides an intuitive example of how Bob can compute the value of a function 
perfectly by storing just a single qubit. Consider the measurement with elements {ri||,IIj_} from 
the previous section. It is easy to see that the outcome _L has zero probability if AND(:c) = 1. 
Thus, if Bob obtains that outcome he can immediately conclude that AND(x) = 0. If Bob obtains 
outcome || then the post-measurement states live in a 2-dimensional Hilbert space (Ti-2), and can 
therefore be stored in a single qubit. Thus, by keeping the remaining state we can calculate the 
AND perfectly once the basis is announced. Our proof in Section which shows that in fact all 
Boolean functions can be computed perfectly if Bob can store only a single qubit, makes use of a 
very similar effect to the one we observed here explicitly. 

4.2.2 XOR function 

We now examine the XOR function. This will be useful in order to gain some insight into the 
usefulness of post-measurement information later. For strings of even length, there exists a simple 
strategy for Bob even when three mutually unbiased bases are used. 

Theorem 4.5. Let n € N be even, and let Px{x) = ^ for all x e {0, l} n . Let B = {+, x, 0} with 
U+ = I® n , U x = H® n and U & = K® n , where K = (I + ia x )/s/2. Then there is a strategy where 
Bob succeeds at PIo-STAR(XOR) with probability p = 1. 

Proof. We first construct Bob's measurement for the first 2 qubits, which will allow him to learn 
x\ © X2 with probability 1. Note that the 12 possible states that Alice sends can be expressed in 
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the Bell b follows: 



|00) = 




■ + $ 


■» 


IP 


52 |00) = 




+ |tf H 


■» 




52 |00) = 




+ i\* + )) 


|01> = 






"» 




52 |01) = 




+ |«- 


■» 




52 |01) = 


>* +; 


> + l*")) 


|10> = 




- 


■» 




52 |10) = 


^(l*-> 


- 


■» 




52 |10) = 


>* +; 


>-!*-» 


lll> = 




- |$" 


■» 


# 5 


52 lll> = 






")) 




52 lll) = 




->-*|* + » 



Bob now simply measures in the Bell basis and records his outcome. If Alice now announces that 
she used the computational basis, Bob concludes that x\ © X2 = if the outcome is one of 
and x\ © X2 = 1 otherwise. If Alice announces she used the Hadamard basis, Bob concludes that 
x\ © X2 = if the outcome was one of {|$ + ), l^" 1 ")} and x\ © x<i = 1 otherwise. Finally, if Alice 
announces that she used the basis, Bob concludes that x% © xi = if the outcome was one of 
{|$~), |^ + )} and x\ © X2 = 1 otherwise. Bob can thus learn the XOR of two bits with probability 
1. To learn the XOR of the entire string, Bob applies this strategy to each two bits individually 
and then computes the XOR of all answers. □ 

Analogously to the proof of Theorem 14.51 we obtain: 

Corollary 4.6. Let n G N be even, and let Px(x) = ^ for all x G {0, l} n . Let B = {+, x} with 
U + = I® n and U x = H® n . Then there is a strategy where Bob succeeds at PI -STAR(XOR) with 
probability p = 1. □ 

Interestingly, there is no equivalent strategy for Bob if n is odd. In fact, as we will show in the 
next section, in this case the post-measurement information gives no advantage to Bob at all. 

Theorem 4.7. Let n G N be odd, and let Px{x) = ^ for all x G {0,1}™. Let B = {+, x} with 
U + = I® n , U x = H® n and P B (+) = P B (x) = 1/2. Then Bob succeeds at PI -STAR(XOR) with 
probability at most 

If 1 



There exists a strategy for Bob that achieves p. 

Proof. Similar to the proof of the AND function, we can write Bob's optimal probability of success 
as the following semidefinite program in terms of the length of the input string, n: 

maximize \ £ o+ ,o xG {0,i} Tr[6™ +0x M 0+0x ] 
subject to Vo + ,o x G {0,1} : M 0+0x > 0, 
Eo+,o x e{o,i}*V»x = ^> 

where 

h n — n n + n n 

u o + o x ro + + > ro x x > 

and Po b b = zZx^OA^^eXOR-Hob) Ub\x)(x\U ] b . The dual can be written as 
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minimize j Tr(Q n ) 

subject to Vo+, o x e {0, 1} : Q n > b n 0+0x . 

Our proof is now by induction on n. For n = 1, let Q 1 = 2pl. It is easy to verify that Vo+, o x £ 
{0, 1} : Q 1 > &o +0x and thus Q 1 is a feasible solution of the dual program. 

We now show that for n + 2, Q n+2 = Q n ®\l is a feasible solution to the dual for n + 2, where 
Q n is a solution for the dual for n. Note that the XOR of all bits in the string can be expressed as 
the XOR of the first n — 2 bits XORed with the XOR of the last two. We can thus write 



n n+2 _ 

Po+ — 


l(Po + 


,0 2 

®Po+ 


+ Po+ 


®P\+) 


n n+2 _ 
Pox — 


2^ox 


,0 2 
® POx 


+ P1X 


®p\x) 




5« + 


®P\+ 


+ P n i + 


®pI+) 


Plx — 




®Plx 


+ P n ix 


®Pox) 



Now note that we can write 

pl + = ~(|oo><oo| + |ii)(ii|) = \(\<f + )(^\ + 1*-><*-|) 
p\ + = §C|oi><oi| + |io)(io|) = ^(|* + X* + | + 1*-><*-|). 

It is easy to see that p% x = Hp 2 Q+ H = + and p 2 x = Hp\ + H = ±(|$-)($-| + 

l 1 ^ - )^ - !). By substituting from the above equation we then obtain 

b n + 2 = P n ot 2 + Pof = \ ((Po+ + P%x)® l* + > (* + l + (PoV + Pix ) ® |*->(*- 1 

(p?+ + p? x ) ® |* + ><* + | + (p?+ + p? x ) ® |*->(*-|)) 

<~Q"®l, 

where we have used the fact that Q n is a feasible solution for the dual for n and that |$ + )( < & + | + 
|$ - >($~| + |tf + >(*+| + |* _ )(* _ | = I. The argument for b™+ 2 , b^ 2 and b^ 2 is analogous. Thus 
Q n+2 satisfies all constraints. 

Putting things together, we have for odd n that Tr(Q n+2 ) = Ti(Q n ) = Ti^Q 1 ) and since the 
dual is a minimization problem we know that p < \ Tr^Q 1 ) = c as claimed. Clearly, there exists 
a strategy for Bob that achieves p = c. He can compute the XOR of the first n — 1 bits perfectly, 
as shown in Theorem 14.61 By Corollary 14.41 he can learn the value of the remaining n-th bit with 
probability p = c. □ 

We obtain a similar bound for three bases: 

Theorem 4.8. Let n G N be odd, and let Px{x) = ^ for all x £ {0, 1}™. Let B = {+, x, 0} with 
U + = l® n , U x = H m and U G = K® n , where K = (1 + ia x )/V2, with P B {+) = P B (x) = P B (Q) = 
1/3. Then Bob succeeds at PIo-STAR(XOR) with probability at most 



2 V 

There exists a strategy for Bob that achieves p. 
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Proof. The proof follows the same lines as Theorem 14.71 Bob's optimal probability of success is: 



maximize - ^ ^K + o x o q m o+o x oq] 



6 

o + ,o x ,o Q e{o,i} 



where 



and 



subject to Vo+,o x ,o G {0,1} G {0,1} : M o+OxO0 > 0, 

M o + o x o Q = I, 

o+,o x ,o Q e{o,i} 



b n =y 

fees 



xexoi?(oi,) 

The dual can be written as 

minimize ^Tr(Q n ) 

subject to Vo + ,o x ,o G {0,1} : Q n > 6" +0x0Q . 

Again, the proof continues by induction on n. For n = 1, let Q 1 = 3pl. It is easy to verify that 
Vo + ,o x ,o G {0,1} : Q 1 > foo + o x o Q an d thus Q 1 is a feasible solution of the dual program. The 
rest of the proof is done exactly in the same way as in Theorem 14.71 using that 

p^ = ^(i<n<<^i + i* + ><* + i) 

pI q = 1(\*-)(*-\ + \<s> + )(<s> + \). 

□ 



5 Quantum memory resources for perfect prediction: 
an algebraic framework 

So far, we had assumed that Bob is not allowed to store any qubits and can only use the additional 
post-measurement information to improve his guess. Now, we investigate the case where he has a 
certain amount of quantum memory at his disposal. In particular, we present a general algebraic 
approach to determine the minimum dimension 2 q of quantum memory needed to succeed with 
probability 1 at an instance of PI g -STAR(£) for any ensemble £ = {p y b, p y b} as long as the individual 
states for different values of y are mutually orthogonal for a fixed b, i.e., Vy / z G y Tr(p y b, p z b) = 
0. We are looking for an instrument (w.l.o.g. maximally refined) consisting of a family of pure 
completely positive maps p \— > ApJv , adding up to a trace preserving map, such that rank A < 2 q . 
This takes care of the memory bound. The fact that after the announcement of b the remaining 
state ApybA^ gives full information about y is expressed by demanding orthogonality of the different 
post-measurement states: 

Vb£B,Vy^z£y A Pyb A^A Pzb A^ = 0. (6) 
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Note that here we explicitly allow the possibility that, say, Ap^A^ = 0: this means that if 
Bob obtains outcome A and later learns b, he can exclude the output value z. What Eq. (jfifl 
also implies is that for all states \tp) and \<p) in the support of p yb and p z b, respectively, on has 
A\ip) (i(j\A^ A\ip){(p\A^ = 0, hence, introducing the support projectors P y b of the p y b, we can refor- 
mulate Eq. © as 

Vb£B,Vy^zey AP yb A^ AP zb A^ = 0, 
which can equivalently be expressed as 

V6 e B,Vy ^ z e y Tx{A ] AP yb A ] AP zb ) = 0. (7) 

As expected, we see that only the POVM operators M = A^A of the instrument play a role in this 
condition. Our conditions can therefore also be written as M P yb M P z b = 0. From this condition, 
we now derive the following lemma. 

Lemma 5.1. Bob, using an instrument with POVM operators {Mi}, succeeds at PI q -STAR with 
probability X, if and only if 

1. for all i, rank M; < 2 q , 

2. for all y S J and b € B, [M, P y b] = 0, where P y b is the projection on the support of p y b- 

Proof. We first show that these two conditions are necessary. Note that only the commutation has 
to be proved: let M be a Kraus element from an instrument succeeding with probability 1. Then, 
for any y, b, we have by Eq. (JJJ) that 

Tr(MP yb M(I- Py b )) = 0, hence Tr (MP yb MP yb ) =Tr(MP yb M). 

Thus, by the positivity of the trace on positive operators, the cyclicity of the trace, and P 2 b = P y b 
we have that 

0<Tr([M,P y bVlM,P yb }) 
= Tr(-(MP yb -P yb M) 2 ) 

= Tr(- MP y bMP y b - P yb M P yb M + P yb M 2 Pyb + MP 2 b M) = 0. 

But that means that the commutator [M, P y b] has to be 0. 

Sufficiency is easy: since the measurement operators commute with the states' support projec- 
tors Pyb (assuming for the moment that they are the signals, not the p y b), and these are orthogonal 
to each other for fixed b, the post-measurement states of these projectors, oc \fMP y b^fM will also 
be mutually orthogonal for fixed b. Thus, if Bob learns b, he can perform a measurement to dis- 
tinguish the different values of y perfectly. The post-measurement states are clearly supported on 
the support of M, which can be stored in q qubits. Since Bob's strategy succeeds with probability 
1, it will succeed with probability 1 for any states supported in the range of the P y b- □ 

It should be pointed out that the operators M of the instrument need not commute with the 
originally given states p y b- Nevertheless, the measurement preserves the orthogonality of p y b and 
p z b with y / z for fixed b, i.e., Tr(p y bP z b) = 0- Now that we know that the POVM operators of 
the instrument have to commute with all the states' support projectors P y b, we can invoke some 
well-developed algebraic machinery to find the optimal such instrument. 



20 



Namely, the M have to come from the commutant of the operators P y b [111 ]. These themselves 
generate a *-subalgebra O of the full operator algebra BiTL) of the underlying Hilbert space H, and 
the structure of such algebras and their commutants in finite dimension is well understood ([Hj, 
Section 1. 11): the Hilbert space TC has a decomposition (i.e., there is an isomorphism which we 
write as an equality) 

n = ^j j ®ic j (8) 

3 

into a direct sum of tensor products, such that the *-algebra O and its commutant algebra O' = 
[M : VP G O [P, M] = 0} can be written 

<D = QB(J j )®I Ki , (9) 

3 

& = @l Jj ®B(K j ). (10) 

3 

Koashi and Imoto |2(|, in the context of finding the quantum operations which leave a set of 
states invariant, have described an algorithm to find the commutant O' , and more precisely the 
Hilbert space decomposition (JHJ), of the states P y b/ Tr P y ^. They show that for this decomposition, 
there exist states <tm on J'j, a conditional probability distribution {qju}, and states Uj on JCj which 
are independent of i, such that we can write them as 

Vi (7i = @qj\i<rj\i®Uj, 
j 

Now, looking at Eq. QlOj). we see that the smallest rank operators M G O' are of the form Ij. <&\^) 
for some j and \ip) G ICj, and that they are all admissible. Since we need a family of operators M 
that are closed to a POVM and thus all j have to occur, the minimal quantum memory requirement 
is 

min2' 3 = max dim J~. (11) 

j 

The strategy Bob has to follow is this: For each j, pick a basis {|e^u)} of the spaces ICj and measure 
the POVM {Ij <g) |efeh')(efcu|}, corresponding to the decomposition 

H = 0^®|e Jfe | i ) ) 

jk 

which commutes with the P y b. For each outcome, he can store the post-measurement state in q 
qubits [as in Eq. (|11|)]. preserving the orthogonality of the states for different y but fixed b. Once 
he learns b he can thus obtain y with certainty. 

Of course, carrying out the Koashi-Imoto algorithm may not be a straightforward task in a 
given situation. Nevertheless, one can understand the two examples we will present in the following 
section as special cases of this general method. 



6 Using post-measurement information and quantum memory 

We now take a look at two specific cases. First, we show that in fact all Boolean functions with 
two bases (mutually unbiased or not) can be computed perfectly when Bob is allowed to store just 
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a single qubit. Second, however, we show that there exist three bases such that for any balanced 
function, Bob must store all qubits to compute the function perfectly. We also give a recipe how 
to construct such bases. 



6.1 Using two bases 



For two bases, Bob needs to store only a single qubit to compute any Boolean function perfectly. 
As outlined in Section |SJ we need to show that there exists a measurement with the following 
properties: First, the posterior states of states corresponding to strings x such that f{x) = are 
orthogonal to the posterior states of states corresponding to strings y such that f{y) = 1. Indeed, 
if this is true and we keep the posterior state, then after the basis is announced we can distinguish 
perfectly between both types of states. Second, of course, we need that the posterior states are 
supported in subspaces of dimension at most 2. The following lemma is the main ingredient in our 
proof. 



Lemma 6.1. Let f : {0, l} n — > {0, 1} and P 6 = Ylxef- 1 ^) ^b\x){x\W b where Uq 
then there exists a direct sum decomposition of the Hilbert space 



I and Ui = U, 



7i = with dim Hi < 2, 
i=i 

such that Pqq and Pqi can be expressed as 

m 

Poo = HFoon^ 

1=1 

m 



i=i 



where Ilj is the orthogonal projector onto Hi. 

Proof. There exists a basis so that Pqo an d -Pqi can be written as 



oo 



Or, 



Ortixno ni xni 



01 



A 00 



A 01 

noxrai 

A} 1 



where n y = is the number of strings x such that f(x) = y, and we have specified the 

dimensions of the matrix blocks for clarity. In what follows these dimensions will be omitted. We 
assume without loss of generality that no < n\. It is easy to check that, since Poi is a projector, it 
must satisfy 



^°°(In 



A ll {l ni -A ll )=A m 'A {>l . 



A 00 ) = A m A m \ 
oit ^01 



iii 



(12) 



Consider a unitary of the following form 



V 



v 

Vx 
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where Vq and V\ are no x no and n\ x m unitaries respectively. Under such a unitary, Poo and Pol 
are transformed to: 



VP 00 V* = Poo, 



V A 00 VJ V A m v} 
(V A 01 V^ ViA xl vl 



We now choose Vq and V\ from the singular value decomposition (SVD, |23j, Theorem 7.3.5]) of 
A 01 = V^DVx which gives 

no 

D = V A 01 Vl =J2 d k\ u k)(vk\, 

k=l 

where d k > 0, (uk\ui) = (vk\vi) = dj-i- Since (A 01 )^A 01 and A 01 (A 01 ) ji are supported in orthogonal 
subspaces, it also holds that \/k,l : (uk\vi) = 0. Equations (|12j) and (fT3)l now give us 

n 



V Q A 00 vJ(l no - V Q A 00 VJ) =^24\u k )(u k \, 

k=l 

n 

VxA n vl(I ni - VxA n v}) = Y,4\v k )(v k \. 



k=l 

Suppose for the time being that all the d k are different. Since they are all non-negative then all 
the d\ will also be different and it must hold that 

n 

V A 00 VJ = ^2a° k \ Uk ){u k \, 

k=l 

n rai 

VyA^Vj = J2 a k\ V k)( v k\ + Yl 4l%X%l 
k=l fc=no+l 

for some a®, a\ and \v k ). Note that we can choose \v k ) such that V7c, k', k ^ k' : (v k \v k /) = and 
I : (u k \vi) = 0. We can now express VPq\V^ as 

n Hi 

VPoiV^ = [a° k \u k )(u k \ + d k (\u k )(v k \ + \v k )(u k \) + a k \v k ){v k \] + Ofc|%)(ujfc|- 

fc=l fc=no+l 

It is now clear that we can choose all TL k = span{|nfc), |i>fc)}> and Tt k i = span{ | v k i ) } which are 
orthogonal and together add up to TL. 

In the case that all the d k are not different, there is some freedom left in choosing \u k ) and \v k ) 
that still allows us to make Vo^4°°Vq^ and Vij4 n V^ diagonal so that the rest of the proof follows in 
the same way. □ 

In particular, the previous lemma implies that the posterior states corresponding to strings x 
for which f{x) = are orthogonal to those corresponding to strings x for which f(x) = 1, which is 
expressed in the following lemma. 
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Lemma 6.2. Suppose one performs the measurement given by {Hi : i G [m]}. If the outcome of 
the measurement is i and the state was Ub\x), then the posterior state is 



{x\UlWJ b \x) 

The posterior states satisfy 

Vx G / _1 (0), x G i G [m] : (x, i, 6|x, i, 6) = 0. 

Proof. The proof follows straightforwardly from that fact that the IT commute with both Poo an d 
Poi (which follows from Lemma l6.1j) . □ 

Now we are ready to prove the main theorem of this section. 

Theorem 6.3. Let \y\ = \B\ = 2, then there exists a strategy for Bob such that he succeeds at 
PIi-STAR(£) with probability p = 1, for any function f and prior Px on X which is uniform on 
the pre-images f~ 1 (y). 

Proof. The strategy that Bob uses is the following: 

• Bob performs the measurement given by {II j : i G [m]}. 

• He will obtain an outcome i £ [m] and store the posterior state which is supported in the at 
most two-dimensional subspace Tii. 

• After the basis b G {0, 1} is announced, he measures {Pob,Pu} and reports the outcome of 
this measurement. 

By Lemma 16.21 this performs with success probability 1. □ 

Our result also gives us a better lower bound for all Boolean functions than what we had 
previously obtained in Section f4. II Instead of storing the qubit, Bob now measures it immediately 
along the lines of Lemma It is easy to see that for one qubit the worst case posterior states to 
distinguish are in fact those in Lemma 13. 11 

Corollary 6.4. Let \y\ = \B\ = 2, then Bob succeeds at PIo-STAR(£) with probability at least 
p> (l + l/V2)/2. □ 



In particular, our result implies that for the task of constructing Rabin-OT in |12| it is essential 
for Alice to choose a random function / from a larger set, which is initially unknown to Bob. 

As a final remark, note that in this result, because we succeed with probability 1, the prior 
distributions do not play any role. Likewise, it is not actually important that the states p y b are 
proportional to projectors: all that is needed in the most general formulation of the discrimination 
problem at the beginning is that for both b G {0, 1}, the states pob and p\b are orthogonal. 
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6.2 Using three bases 

We have just shown that Bob can compute any Boolean function perfectly when two bases are 
used. However, we now show that for any balanced Boolean function there exist three bases, such 
that Bob needs to store all qubits, in order to compute the function perfectly. The idea behind 
our proof is that for a particular choice of three bases, any measurement operator that satisfies the 
conditions set out in Lemma 15. II must be proportional to the identity. This means that we cannot 
reduce the number of qubits to be stored by a measurement and must keep everything. First, we 
prove the following lemma which we will need in our main proof. 

Lemma 6.5. Let M be a selfadjoint matrix which is diagonal in two mutually unbiased bases, then 
M must be proportional to the identity. 

Proof. Let \x) \u x ) x G {1, . . . , d} be the two MUBs and let m x be the eigenvalue corresponding to 
\x) and \u x ), then we can write 



M = ^2m x \x)(x\ = m x '\u x ')(u x '\. 



2 = 1 



x'=l 



From the previous equation, it follows that 



(x\M\x) = m x = 



m T ' v x) 



TrM, 



which implies the desired result. 

We are now ready to prove the main result of this section. 



□ 



Theorem 6.6. Let \y\ = 2 and \B\ = 3, then for any balanced function f and prior Px on X which 
is uniform on the pre-images f~ 1 (y), there exist three bases such that Bob succeeds at PI g -STAR(<5) 
with probability p = 1 if and only if q = log d. 



Proof. Let P 00 = E* 6 /-i(o) l x >H P oi = UxWl and P 02 = U 2 P m Ul Also, let a : f~\0) 

be a bijective map, and let s x = s(x). By a reordering of the basis, Poo, U\ and U2 can be 
written as 



rt 



00 



I 




,u 2 



where all the blocks are of size (d/2) x (d/2). Pqi an d P02 then take the following form: 



P01 



E/™E/° ot U°°Ul° 



lOrrlot 



,P)2 



([/ 2 00 c/ 2 10t )t upup* 



It follows from Lemma 15. 11 that we only need to prove that [M, Poo] = [M, P01] = [M, P02] = 
implies that M must be proportional to the identity. Write 



M 



' M 00 

_(M 01 )t 



M 01 ' 
M 11 
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Commutation with Pqo implies M 01 = 0. Commutation with Pqi an d P02 implies 



[M 00 ,Uf°U^] = [M 00 ,[/ 2 00 C/ 2 00t ] =0, (13) 

[M n ,Ul°U}°*] = [M n ,Ui°U^]=0, (14) 
M oo ([/ oo [/ iot ) = (^lot^n (15) 

M 00 (C/ 2 00 C/ 2 10t ) = (U™U^)M n . (16) 

We choose Lq and t/2 in the following way: 

Ui= ^2 [ a x(\x){x\ + \s x ){s x \) + y^T^a%(\x)(s x \- \s x ){x\) , 
X6/-H0) 

^2= E [ax(|-Ux)(wx| + K)(«a;|) + \A - o|(hx)(«x| - \v x ){u x \) , 
xef-i(o) 

with a x 6 [0,1], satisfying if and only if x = x'. Furthermore, choose and such 

that 

Vx,^ G / _1 (0), = (Sxl^s') = 0, KxK')! 2 = Ksa-IVa,')] 2 = {d/2)' 1 . 

With this choice for XJ\ and C/ 2 we have that 

u™uf= Y: 

xe/-!(o) 

^ 2 00t = £ **>w> 

i.e., {\x}} and {(liz)} form an eigenbasis for [/TO * and [/ 2 00 E/ 2 oot respectively. Furthermore, since 
all the a x are different, the eigenbases are unique. Now, using Eq. ([T3|) . we see that M 00 must 
commute with both U^Uf ^ and [/ 2 °C/ 2 ^, and since their eigenbases are unique, it must be true 
that M 00 is diagonal in both {\x}} and Using the result of Lemma 16.51 it follows that 

M 00 = mold/2- I n exactly the same way we can prove that M 11 = mil^/a using Eq. (|14j) . It 
remains to prove that mo = mi, which follows directly from either Eq. (|15|) or Eq. ()16|) . □ 

From our proof it is clear how to construct appropriate U\ and C/2- Note, however, that whereas 
we know that for such unitaries Bob must store all qubits in order to compute the value of the 
function perfectly, it remains unclear how close he can come to computing the function perfectly. 
In particular, he can always choose two of the three bases, and employ the strategy outlined in the 
previous section: he stores the one qubit that allows him to succeed with probability 1. If he gets the 
third basis then he just flips a coin. In this case, he is correct with probability 2/3 + 1/(3 • 2) = 5/6 
for a balanced function and a uniform prior. 



7 Conclusion and open questions 

We have introduced a new state discrimination problem, motivated by cryptography: discrimination 
with extra information about the state after the measurement, or, more generally, after a quantum 



26 



memory bound applies. We have left most general questions open, but we found fairly complete 
results in the case of guessing y = f(x) with mutually unbiased encodings. 

We have shown that storing just a single qubit allows Bob to succeed at PI-STAR perfectly for 
any Boolean function and any two bases. On the contrary, we showed how to construct three bases 
such that Bob needs to store all qubits in order to compute the function perfectly. 

We have also given an explicit strategy for two functions, namely the AND and the XOR. More 
generally, it would be interesting to find out, how many qubits Bob needs to store to compute f(x) 
perfectly for any function / : X — > y in terms of the number of outputs \y\ and the number of 
bases \B\. It should be clear that the algebraic techniques of Section [S] allow us to answer these 
questions for any given function in principle. However, so far, we have not been able to obtain 
general structures for wider classes of functions. 

Our results imply that in existing protocols in the bounded quantum storage model 0| we 
cannot restrict ourselves to a single fixed function /. However, a great challenge arises in considering 
more than one function, where / is also announced after the memory bound applies 

In general, it is an interesting problem to consider when post-measurement information is useful 
and how large the advantage can be for Bob. In the important case of two mutually unbiased bases 
and balanced functions, we have shown (Theorem 13.31 and Corollary 16.4)1 that there exists a clear 
separation between the case where Bob gets the post-measurement information (PI-STAR) and 
when he does not (STAR). Namely, for any such function, Bob's optimal success probability is 
never larger than (1 + l/y/2)/2 ~ 0.853 for STAR and always at least as large as the same number 
for PI-STAR. 

In some cases the gap between STAR and PI-STAR can be more dramatic. The XOR function 
on strings of even length with two mutually unbiased bases is one of these cases. We have shown 
that in this case the advantage can be maximal. Namely, without the extra information Bob can 
never do better than guessing the basis, with it however, he can compute the value of the function 
perfectly. This contrasts with the XOR function on strings of odd length, where the optimal success 
probabilities of STAR and PI-STAR are both (1 + l/v2)/2 and the post-measurement information 
is completely useless for Bob. It would be interesting to see, how large the gap between STAR and 
PI-STAR can be for any function / : {0, l} n — ► {0, l} k where k > 2. It would also be nice to show 
a general lower bound for non-balanced functions or a non-uniform prior. As the example for 3 
bases showed, the uniform prior is not necessarily the one that leads to the largest gap, and thus 
the prior can play an important role. Another generalization would be to consider functions of the 
form / : [d] n -> [d} k . 

We close by pointing out a potentially interesting connection to the problem of information 
locking with mutually unbiased bases 0] and random bases There, the objective is not so 
much to obtain an accurate guess of the value y = f(x), as to maximize the (classical) mutual 
information at the end. In locking, we distinguish measurement with basis information, analogous 
to our Plq-STAR with q = n, and without (or rather only after the measurement), corresponding to 
PIo-STAR. From a classical perspective, it is surprising that the difference in attainable accessible 
information between q = n and q = can be much larger than the information contained in a 
message specifying which basis was used. In our scenario, we are not interested in locking a string 
x, but in locking f(x) for a fixed function /. The strength of the observed locking effect depends 
on the ratio of the number of values / can take and the number of bases used. The dependence 
on the number of bases carries over to information locking [2oT ] , but see the cautionary tale of 0] • 
It would be interesting to generalize information locking to intermediate values of q, but it seems 
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that we first need to understand the intricate conditions the bases have to meet to ensure locking 
in the first place. 
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A. Optimal measurement for the AND function 



For the interested reader, we present the line of thought of deriving the optimal measurement of computing 
the AND function, when we are allowed to use post-measurement information. Here, Bob is not allowed to 
store any qubits. 

Supported by numerical calculations we construct the following measurement: 

Moo = n ± 

M 0+ o x — -^o + o x \lpo + o x ) (V'o+Ox I, 

for some IV'o+ox) € Ti-2, for o+o x ^ 00 chosen later. Since EEii \tp 0+ o x ) = IV'o+ox) we can express Bob's 
probability of success using such a measurement as 



1 



Tr[6 00 n ± ]+ Yl Tr[n||6 0+0x n||M 0+0 J 

o + o x e{0,l} : o + o x ^oo 



(17) 



When we project boi, 610 and &n onto Ti.2 we obtain 

I c ) (c | 



nupo+n,. 



l 



niipoxii 



\h ){h \ 



(18) 



n ||Pi+ n || = Pi+ = |ci> <ci | , 
Substituting into Eauation ll7l we then get 
1 



II||Pi x II|l = pi x = \hi)(hi\ 



P - 



2" - 1 2 r ' 
(h Q \M w \ho) , 



1 



2" - 1 

Now using that M\\ = Iln — Mqi — Mio we get 



ci|Mio|ci) + (ci|Mn|ci) + (/ii|Mn|/n) 



1 

P= 4 



2"-2 (co|Afoi|co) 
2— r H — : Ci Moi Ci 



1 



2™ - 1 



(h \M w \h Q ) 
2" - 1 



- (h 1 \M 1Q \h 1 ) + 2 



We now show how to choose \^po + o x )■ We take A = Aoi = Aio- Then s% and S2, the only possible nonzero 
eigenvalues of 



satisfy 



Moi + Mio = AdV'oiXV'oil + |Vio)(^io|), 
si + s 2 = 2A 

S 2 + s 2 = 2A 2 (l + | W >oi|V'io)| 2 )- 

From these two equations one gets 

ai = A(l + 77), 
s 2 = A(l - 77), 

where 77 e 4 * = ("0io IV'oi) 1 ■ Recall that we need to have M01 + Mio + Mn = Hi 1 , which is equal to the identity 
on Ti.2- We therefore want one of the eigenvalues of Mqi + Mio to be 1 and the other one smaller than 1. So 



1 ln the present context e"* = ±1 
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we must choose A = (1 + 77) 1 . We then also need 

277 



An = 
IV11) = 



1 + 77' 

I V01) - e^|Vio> 



We then take, supported by the symmetry of the problem, 

I Voi) = «|co) +/3|ci), 
IV10) = a\h )+/3\h 1 ), 

with a and /3 real and satisfying a 2 + [3 2 = 1. We have now that 

v2 _ fl2 



(V10IV01) = (-1) 



= f-l)™ +1 - — 



2 «/2 



Now p becomes 



2™ - 2 



1 



2™ - 1 I + 77 V2™ - 1 

2" - 2 1 1 - 2 n 3 2 

I — 

2™ - 1 I + 77 2" - 1 



and 



77 = 



a 2 - f3 2 + (-l)"+ 1 2a/V2 7rr T 



2 n/2 



1 - 2/3 2 + (-l) n+1 2/3 v /l - d 2 ^2F^\ 



2 n/2 

where without loss of generality we have chosen a to be positive. We want 77 to be small. It is easy to see 
that we would like to take 8 = (— for some real 3'. A simple calculation shows that then to minimize 
77 we should choose 



1 



V2 2 ™ + 2i n+1 - 2t +1 ' 
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